Is it safe to connect AI to a PLC?
It can be done safely only if the agent cannot write, or its writes are gated behind a human approval, and it starts on a test rig rather than a running line. The tools differ a lot: as of 3 November 2026, OT AI Hub classifies 5 of the 21 industrial MCP servers it lists as exposing write tools by default. 14 gate writes behind a setting, 1 is read-only, and 1 works only inside the engineering IDE.
The count is the industrial MCP servers in this index, from the write-policy field. Edge products and benchmarks are not in it. Quote last verified with the figure.
As of 3 November 2026
- Industrial MCP servers
- 21
This is not a safety case. The counts describe the public tool surface on each entry's last-verified date. They do not certify a server, a model, a network, or a plant. A gated write is still a write once you arm it.
The real question is write scope
The useful question is what this process can change, and what has to happen before that change is possible. A client that can only read cannot start a motor. A client with a write tool can, if the controller accepts the call. The four labels below are the methodology definitions. This page does not invent a second taxonomy.
Read-only means the public tools we checked can browse, read, or diagnose. A write, download, or setpoint tool was not in that surface.
Writes gated means a write exists, and it stays off until someone arms it with a flag, an environment variable, or an explicit apply step. A gated write is still a write once you arm it.
Writes exposed means a write tool is on by default. Nothing has to be armed before a client can change a value, a program, or a setpoint.
Inside the IDE means the assistant or add-on works in an engineering environment, on the open project. It is not a field-protocol client on the plant network.
Then read the account and the route. A read-only OPC UA user can reject a write the server offers. A wide user can accept one it was never meant to send. A gated write is still a write once you arm it.
What today's MCP servers actually allow
The table is all 21 industrial MCP servers, grouped by write policy, as of 3 November 2026. A row is the catalog description. The caveat is on the tool page.
The only read-only entry is Proxus Industrial MCP Server. Proxus says no tool writes a value, starts a machine, or changes a controller, and the assistant can reach only devices named in proxus-mcp.json. It is tagged Modbus and OPC UA. The checked build was beta 0.1.0-beta.5. No source license was stated. The Proxus platform MCP is a different product. See the read-only page.
The gates are not the same switch. IndustriConnect OPC UA MCP keeps writes behind an operator profile, an allow-list, and a pinned certificate or trust store. Other IndustriConnect servers stay off until their documented switch is set. plctap does not register plc_write or send_frame unless PLCTAP_ALLOW_WRITE=true. In v0.6.2 its OPC UA path is read-only, at SecurityPolicy None. twincat-mcp arms dangerous operations before it can deploy to a TwinCAT runtime. ignition-mcp (community) says to start read-only. Ignition MCP Module ships no primitives: you script the tools, including any write. A gated write is still a write once you arm it. The set is on the writes-gated page.
Writes exposed means the write tool is registered when the process starts. kukapay/opcua-mcp publishes write_opcua_node and a multi-write, with no documented allow-list or arming switch. kukapay/modbus-mcp includes writes in the default tool list and has no register map. OPC Foundation OPC UA MCP can narrow its catalog with profiles, but the default profile is broad and UA services include writes. FieldWorks protocol adapters put setpoint writes on the shared surface. Modbus, DNP3, and EtherNet/IP adapters are stubs. AWS IoT SiteWise MCP Server does not speak a field bus. Asset writes are on the API surface, and IAM is the permission boundary. The set is on the writes-exposed page.
The IDE case is CODESYS Development System MCP Server. It edits the open project and does not open a field session. CODESYS recommends Git because undo is limited. The download is still a separate, human step. That boundary is inside the IDE.
Grouped from read-only to inside the IDE. Open a name for sources and the last-verified date.
| Server | Write policy | Protocols | What the entry says |
|---|---|---|---|
| Read-only1 | |||
| Proxus Industrial MCP Server | Read-only | Modbus, OPC UA | Read-only Modbus TCP and OPC UA server with named register maps and a connection diagnostic. |
| Writes gated14 | |||
| Ignition MCP Module | Writes gated | None | Inductive Automation's early-access gateway module. You define the tools; the module does not ship a protocol driver. |
| ignition-mcp (community) | Writes gated | None | Unofficial Ignition 8.3 module with a fixed tool list for tags, projects, alarms, and gated writes. |
| IndustriConnect BACnet MCP | Writes gated | BACnet | BACnet/IP client for Who-Is discovery and property reads and writes, with a mock device. |
| IndustriConnect DNP3 MCP | Writes gated | DNP3 | DNP3 master for outstations and serial-to-TCP gateways, with a mock outstation. |
| IndustriConnect EtherCAT MCP | Writes gated | EtherCAT | PySOEM EtherCAT master exposed as MCP tools. Hardware use is not claimed as done. |
| IndustriConnect EtherNet/IP MCP | Writes gated | EtherNet/IP | Logix tag client for ControlLogix, CompactLogix, and Micro800, using pycomm3, plus a JSON mock. |
| IndustriConnect Modbus MCP | Writes gated | Modbus | Open-source Modbus TCP, UDP, and RTU client for MCP hosts, with a mock device and writes off by default. |
| IndustriConnect MQTT / Sparkplug MCP | Writes gated | MQTT / Sparkplug | MQTT client that publishes, subscribes, and decodes Sparkplug B instead of handing the model raw bytes. |
| IndustriConnect OPC UA MCP | Writes gated | OPC UA | Python and Node OPC UA MCP servers with the same tools: browse, read, history, alarms, and gated writes. |
| IndustriConnect PROFIBUS MCP | Writes gated | PROFIBUS | PROFIBUS DP tooling with GSD parsing and a TCP mock. A real DP master is not implemented. |
| IndustriConnect PROFINET MCP | Writes gated | PROFINET | PROFINET DCP discovery and GSDML parsing. Cyclic I/O in the public server goes through a mock. |
| IndustriConnect S7 MCP | Writes gated | Siemens S7 | S7comm client for S7-300 through S7-1500 via python-snap7, with a mock PLC for DB, I/O, and SZL tests. |
| plctap | Writes gated | Modbus, FINS, MELSEC / SLMP, Siemens S7, IEC 60870-5-104, EtherNet/IP, OPC UA | One MCP server for Modbus, FINS, MELSEC, S7, IEC 104, EtherNet/IP, and OPC UA, with protocol detection. |
| twincat-mcp | Writes gated | ADS, IEC 61131-3 | Unofficial MCP server over the TwinCAT Automation Interface and ADS: build, deploy, read, and write. |
| Writes exposed5 | |||
| AWS IoT SiteWise MCP Server | Writes exposed | None | AWS Labs MCP server for SiteWise asset models, time series, and related industrial data in an AWS account. |
| FieldWorks protocol adapters | Writes exposed | MQTT / Sparkplug, OPC UA | Rust MCP adapters with one tool surface. MQTT and OPC UA are implemented; Modbus, DNP3, and EtherNet/IP are stubs. |
| kukapay/modbus-mcp | Writes exposed | Modbus | Python Modbus MCP server for TCP, UDP, or serial, including write tools in the default set. |
| kukapay/opcua-mcp | Writes exposed | OPC UA | Small Python OPC UA MCP server with read, write, browse, and batch tools turned on together. |
| OPC Foundation OPC UA MCP | Writes exposed | OPC UA | Official .NET tool that exposes OPC UA services to MCP clients, with selectable tool profiles. |
| Inside the IDE1 | |||
| CODESYS Development System MCP Server | Inside the IDE | IEC 61131-3 | Official CODESYS add-on that lets an MCP client read and write the open project, compile, and fix Structured Text. |
What the research shows
Two studies sit next to the count. They do not measure the same thing, and neither result is from your plant. Figures are the ones already on the leaderboard.
PLCBench: an agent reached a physical objective in a lab
In the PLCBench study (August 2026), a tool-using agent given network reach to a commercial PLC produced a sustained physical effect that the evaluator accepted in 75 of 240 episodes (31.3%). PLCBench links the paper (arXiv:2608.26882).
31.3% is not a vulnerability you can transfer to your plant, and it is not evidence that any listed copilot is safe. The result is one lab setup. This page does not restate how the episodes were run.
PLCWorld: higher success can come with higher safety violation rates
PLCWorld grades Structured Text in closed loop, not a live protocol session. The row "Hard material handling, Gemini 3.1 Pro vs GPT-5.5" reports task success of 35.25% vs 27.87%. The paired safety-violation rate is 51.95% vs 32.24%. Higher success can come with higher safety violation rates. PLCWorld links arXiv:2610.02982.
Do not line these percentages up with AutoFactory-Bench. A program that reaches the goal can still trip a safety rule. Only figures stated in the paper text are transcribed.
A pilot setup that keeps writes off
Seven controls, one line each, before a client is pointed at a controller:
- Start on a read-only server, or leave every gated write disarmed.
- Give the protocol session a user that can read only the points you named.
- Place the MCP host on its own segment or DMZ, with no route to the running controllers.
- Use a test rig or the project's simulator for the first connection, not the line.
- Log every tool call, arguments included, on a system the agent cannot edit.
- Require a person to approve any write, including one you later arm on purpose.
- Restore a backup in the lab before a write exists, and know which program you would roll back to.
Engineering-time AI vs runtime AI
Engineering-time AI edits a project. The vendor PLC copilots propose a change, a person reviews it, and a person downloads it. The CODESYS server is the same shape over MCP. Inside the IDE is that boundary.
Runtime AI holds a session on Modbus, OPC UA, or another live protocol while the process is running. That is the path PLCBench studied. The PLC copilots comparison keeps the engineering assistants on their own table. The compare hub still lists field MCP servers. A project edit can still become a plant change at the next download. Approve the two risks separately.
Mapping to existing guidance
On 3 December 2025, CISA and the Australian Cyber Security Centre, with the NSA Artificial Intelligence Security Center and other partners, published Principles for the Secure Integration of Artificial Intelligence in Operational Technology. The principles are to understand AI, to decide whether it belongs in OT, to govern it, and to keep a person in critical decisions. The sheet does not score MCP servers. This page does not restate it.
IEC 62443 zones and conduits are the network drawing under that advice. An MCP host that can open a session to a PLC is a conduit into that zone. Keep the conduit in a test zone until the write scope is an accepted change. A read-only session is still a conduit. It is a narrower one.
FAQ
Is it safe to connect an AI agent to a PLC?
It can be done safely only if the agent cannot write, or its writes are gated behind a human approval, and it starts on a test rig rather than a running line. The tools differ a lot: as of 3 November 2026, OT AI Hub classifies 5 of the 21 industrial MCP servers it lists as exposing write tools by default. 14 gate writes behind a setting, 1 is read-only, and 1 works only inside the engineering IDE.
Which industrial MCP servers are read-only?
As of 3 November 2026, 1 of 21 industrial MCP servers is read-only: Proxus Industrial MCP Server. The checked tools can browse, read, or diagnose. A write tool was not in that surface. This is not a safety case.
What does "writes gated" mean for an MCP server?
On OT AI Hub, "writes gated" means the MCP server has a write tool, but it stays off until you deliberately enable it with a flag, setting or allow-list. "Writes exposed" means the write tool is available as soon as the server runs. Neither label is a safety case: a gated write is still a write once you arm it.
Can an AI agent cause a physical effect through a PLC?
In a lab, yes. In the PLCBench study (August 2026), a tool-using agent given network reach to a commercial PLC produced a sustained physical effect that the evaluator accepted in 75 of 240 episodes (31.3%). The result comes from one lab setup and does not transfer directly to any plant, but it shows that network reachability plus write-capable tools is enough for an agent to change a process.
What controls should be in place before a pilot?
Use a read-only server or leave gated writes disarmed, a least-privilege protocol user, a separate segment or DMZ, a test rig or simulator, a log the agent cannot edit, a person to approve any write, and a backup you have restored. This is not a safety case.
Sources
Last verified for the write-policy count: 2026-11-03. Quote that date with the figure. A later crawl of this site does not move it. Server sources are on the linked tool pages.
- Write-policy definitions
- Read-only industrial MCP servers
- PLCBench on the leaderboard
- PLCBench paperhttps://arxiv.org/abs/2608.26882
- PLCWorld on the leaderboard
- PLCWorld paperhttps://arxiv.org/abs/2610.02982
- Principles for the Secure Integration of Artificial Intelligence in Operational Technology3 December 2025.https://www.cisa.gov/resources-tools/resources/principles-secure-integration-artificial-intelligence-operational-technology
- OPC UA MCP servers compared
- Modbus MCP servers compared
This is not a safety case. The counts describe the public tool surface on each entry's last-verified date. They do not certify a server, a model, a network, or a plant. A gated write is still a write once you arm it.